CmdID

CmdID / Techniques

T1012 Query Registry

Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software. MITRE ATT&CK

1 program on CmdID 7 Sigma rules T1012 on attack.mitre.org

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules
reg.exeits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first
highExports Critical Registry Keys To a FileOddvar Moe, Sander Wiebing, oscd.community · Windows
highHackTool - PCHunter ExecutionFlorian Roth (Nextron Systems), Nasreddine Bencherchali · Windows
highOperation Wocao ActivityFlorian Roth (Nextron Systems), frack113 · Windows
highPotential Baby Shark Malware ActivityFlorian Roth (Nextron Systems) · Windows
mediumPotential Configuration And Service Reconnaissance Via Reg.EXETimur Zinniatullin, oscd.community · Windows
mediumRegistry Enumeration via WMI StdregprovSwachchhanda Shrawan Poudel (Nextron Systems) · Windows
lowExports Registry Key To a FileOddvar Moe, Sander Wiebing, oscd.community · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Export a specific registry key and contents to a file on the page for regedit.exe

regedit -E path/to/file path/to/registry_keyIdentify

An example is here when CmdID’s reading of it names T1012: a Sigma rule it trips is tagged with it, or its abuse is documented as it.